Systems and methods for multicast retransmission over a secure wireless LAN
View Patent ↗Systems and methods for broadcast and multicast retransmissions within a protected wireless communications system are described. Retransmitted broadcast or multicast frames are designated by modification of fields or subfields in the MAC header of the frame which are constituent parts of the additional authentication data used to generate encryption keys. Such modifications cause legacy receivers to disregard the retransmitted frames or render legacy receivers to be unable to decrypt the retransmitted frame, avoiding the generation of duplicate frames. Non-legacy receivers recognizing the modification conventions can restore the MAC header to the original state and can reconstruct the original encryption keys and decrypt the retransmitted frames. A non-legacy transmitter can retransmit a frame without the need to re-encrypt the frame.
1. A method for retransmitting an encrypted broadcast-multicast frame comprising an encrypted frame body and a media access control (MAC) header including a retry subfield having a bit, the method comprising:
making a modification to one or more fields within the MAC header of the encrypted broadcast-multicast frame, wherein the one or more fields before the modification are included in additional authentication data (AAD) used to generate an encryption key of the encrypted frame body, and wherein the one or more fields with the modification is indicative of a retransmission of the encrypted broadcast-multicast frame; and
transmitting the encrypted broadcast-multicast frame with the modification to the field and the encrypted frame body;
wherein the modification can be reversed by a station receiving the encrypted broadcast-multicast frame by recognizing that the modification in the one or more fields indicates that the encrypted broadcast-multicast frame with the modification is the retransmission of the encrypted broadcast-multicast frame, and wherein the station reconstructs the AAD of the original encrypted broadcast-multicast frame by reversing the modification and determines the encryption key of the encrypted frame body based on the reconstructed AAD.
2. The method of claim 1 , further comprising setting the bit of the retry subfield of the frame control field.
3. The method of claim 1 , wherein the one or more fields is a source address.
4. The method of claim 1 , wherein the one or more fields is a destination address.
5. The method of claim 1 , wherein the one or more fields is a basic service set identifier (BSSID).
6. The method of claim 1 , wherein the one or more fields is an address field comprising a prefix and making a modification comprises modifying the prefix.
7. A method for processing an encrypted broadcast-multicast frame comprising:
receiving the encrypted broadcast-multicast frame comprising an encrypted frame body and a media access control (MAC) header including a retry subfield having a bit;
determining if the encrypted broadcast-multicast frame is a retransmission of the encrypted broadcast-multicast frame by recognizing a predetermined modification to one or more fields within the MAC header of the encrypted broadcast-multicast frame, wherein the one or more fields before the predetermined modification are included in additional authentication data (AAD) used to generate an encryption key of the encrypted frame body, and wherein the one or more fields with the predetermined modification is indicative of the retransmission of the encrypted broadcast-multicast frame;
in response to recognizing the predetermined modification to the one or more fields within the MAC header, reversing the predetermined modification to the one or more fields within the MAC header to reconstruct the AAD of the original encrypted broadcast-multicast frame, and determining the encryption key of the encrypted frame body based on the reconstructed AAD; and
decrypting the encrypted broadcast-multicast frame after the reversing of the predetermined modification to the one or more fields within the MAC header.
8. The method of claim 7 , further comprising determining if the bit of the retry subfield of the frame control field is set.
9. The method of claim 7 , wherein the one or more fields is a source address.
10. The method of claim 7 , wherein the one or more fields is a destination address.
11. The method of claim 7 , wherein the one or more fields is a BSSID.
12. The method of claim 7 , wherein the one or more fields is an address field comprising a prefix and the predetermined modification comprises a modification to the prefix.
13. An access point configured for retransmitting an encrypted broadcast-multicast frame comprising an encrypted frame body and a media access control (MAC) header including a retry subfield having a bit, the access point comprising:
a processor;
a wireless network interface device; and
a memory comprising instructions;
the instructions causing:
the processor to make a modification to one or more fields within the MAC header of the encrypted broadcast-multicast frame, wherein the one or more fields before the modification are included in additional authentication data (AAD) used to generate an encryption key of the encrypted frame body, and wherein the one or more fields with the modification is indicative of a retransmission of the encrypted broadcast-multicast frame; and
the wireless network interface device to transmit the encrypted broadcast-multicast frame with the modification to the field and the encrypted frame body;
wherein the modification can be reversed by a station receiving the encrypted broadcast-multicast frame by recognizing that the modification in the one or more fields indicates that the encrypted broadcast-multicast frame with the modification is the retransmission of the encrypted broadcast-multicast frame, and wherein the station reconstructs the AAD of the original encrypted broadcast-multicast frame by reversing the modification and determines the encryption key of the encrypted frame body based on the reconstructed AAD.
14. The access point of claim 13 , wherein the instructions further cause the processor to set the bit of the retry subfield of the frame control field.
15. The access point of claim 13 , wherein the one or more fields is a source address, a destination address, a BSSID or a combination thereof.
16. The access point of claim 13 , wherein the one or more fields is an address field comprising a prefix and the instructions cause the processor to make the modification to the field by modifying the prefix.
17. The access point of claim 13 , wherein the access point retransmits the encrypted broadcast-multicast frame to a station, the station comprising:
a processor;
a wireless network interface device; and
a memory comprising instructions;
the instructions causing the wireless network interface device to receive the encrypted broadcast-multicast frame comprising the MAC header; and causing the processor
to determine if the encrypted broadcast-multicast frame is the retransmission of the encrypted broadcast-multicast frame by recognizing the predetermined modification to one or more fields within the MAC header of the encrypted broadcast-multicast frame, wherein the one or more fields before the predetermined modification are included in additional authentication data (AAD) used to generate the encryption key of the encrypted frame body, and wherein the one or more fields with the predetermined modification is indicative of the retransmission of the encrypted broadcast-multicast frame;
if the encrypted broadcast-multicast frame is the retransmission, to reverse the predetermined modification to one or more fields within the MAC header to reconstruct the AAD of the original encrypted broadcast-multicast frame, and to determine the encryption key of the encrypted frame body based on the reconstructed AAD; and
to decrypt the encrypted broadcast-multicast frame if the encrypted broadcast-multicast frame has not already been received.
18. A station comprising:
a processor;
a wireless network interface device; and
a memory comprising instructions;
the instructions causing the wireless network interface device to receive an encrypted broadcast-multicast frame comprising an encrypted frame body and a media access control (MAC) header including a retry subfield having a bit; and causing the processor:
to determine if the encrypted broadcast-multicast frame is a retransmission of the encrypted broadcast-multicast frame by recognizing a predetermined modification to one or more fields within the MAC header of the encrypted broadcast-multicast frame, wherein the one or more fields before the predetermined modification are included in additional authentication data (AAD) used to generate an encryption key of the encrypted frame body, and wherein the one or more fields with the predetermined modification is indicative of the retransmission of the encrypted broadcast-multicast frame;
in response to recognizing the predetermined modification to the one or more fields within the MAC header, to reverse the predetermined modification to the one or more fields within the MAC header to reconstruct the AAD of the original encrypted broadcast-multicast frame, and to determine the encryption key of the encrypted frame body based on the reconstructed AAD; and
to decrypt the encrypted broadcast-multicast frame after reversing the predetermined modification to the one or more fields within the MAC header.
19. The station of claim 18 , wherein the processor determines if the bit of the retry subfield of the frame control field is set.
20. The station of claim 18 , wherein the one or more fields is a source address or a destination address or a BSSID.
21. The station of claim 18 , wherein the one or more fields is an address field comprising a prefix and the predetermined modification comprises a modification to the prefix.